NIS2 Compliance Guide for Secure Communications
NIS2 (Network and Information Security Directive 2) is the EU’s updated cybersecurity framework, which entered into force on 16 January 2023 replacing the original NIS Directive from 2016. Member states had until 17 October 2024 to transpose it into national legislation, with the rules applying from 18 October 2024, and many organizations are still working out what it means for their day-to-day operations.
Quick Answer
NIS2 compliance is an organizational outcome, not a product certification. Communication platforms can support risk-management measures such as access control, cryptography, incident handling, supply-chain security, and business continuity, but no single platform makes an organization NIS2 compliant on its own. Compliance depends on how the organization assesses risk, configures and operates its systems, documents controls, monitors effectiveness, and meets the requirements of the relevant national transposition.
NIS2 distinguishes essential and important entities primarily by sector, entity type, and applicable size thresholds. The exact classification should be checked against the NIS2 Directive on EUR-Lex and the relevant national transposition.
Essential entities and important entities are classified by sector, entity type, and size rules rather than by a simple large-versus-mid-sized split. Essential entities are generally subject to more proactive supervision, while important entities are typically supervised ex post, but both categories are subject to the core cybersecurity risk-management obligations in Article 21.
What NIS2 actually requires organizations to do:
- Maintain risk analysis and information security policies
- Handle and report incidents within defined timeframes
- Plan for business continuity and crisis scenarios
- Assess supply chain security
- Ensure secure acquisition, development, and maintenance of systems
- Run cybersecurity training and awareness programs
- Apply cryptography and encryption where appropriate
- Enforce access controls and manage assets properly
- Use multi-factor authentication or continuous authentication where appropriate, particularly for privileged, remote, and sensitive access
NIS2 requires Member States to provide maximum administrative fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher. NIS2 also places explicit cybersecurity governance duties on management bodies; the precise individual liability and enforcement mechanisms depend on national transposition.
Why Your Communication Stack Is a Compliance Risk?
Here’s something that often gets overlooked: NIS2 risk-management obligations apply to the network and information systems organizations use to store, process, and transmit data, including communication tools that carry sensitive organizational information.
These systems touch strategic decisions, client communications, and internal data that organizations genuinely cannot afford to expose.
Where standard communication tools tend to fall short:
- Unauthorized access to live meetings or archived message histories
- Video, audio, and file transfers sent without encryption in transit
- Data-location and supplier-dependency risks when organizations lack visibility or contractual control over where and how communication data is processed
- Weak access controls that let unauthorized participants into calls or file repositories
- Absent or insufficient audit trails can significantly hinder incident investigation and reduce the evidence available for NIS2 reporting
- Uncontrolled third-party integrations that quietly expand your attack surface
NIS2 requires organizations to address supply-chain security, including security-related aspects of relationships with direct suppliers and service providers. A cloud provider incident can therefore affect the organization’s own risk and reporting obligations. Deploying on your own infrastructure can reduce dependency on vendor-operated cloud infrastructure, while software supply-chain, support, update, and integration risks still require assessment.
Security Risks Broken Down by Communication Channel
Video Conferencing
|
Risk |
What It Means in Practice |
|---|---|
|
Unauthorized meeting access |
Weak guest controls, exposed meeting links, or insufficient authentication can allow unauthorized participants into live sessions |
|
Inadequately protected media or signaling |
Weak or misconfigured transport protection can expose meeting traffic or control data to interception or manipulation |
|
Uncontrolled recording access |
Recordings can contain sensitive discussions and require defined access, retention, and deletion controls |
|
Insufficient meeting and admin audit trails |
Limited visibility into joins, authentication events, configuration changes, and administrative actions can hinder incident investigation |
|
Third-party cloud and integration dependencies |
External hosting, identity, recording, transcription, or integration services add supplier dependencies that should be included in the organization’s risk assessment |
Messaging
|
Risk |
What It Means in Practice |
|---|---|
|
Plaintext storage |
Messages stored without encryption at rest are fully exposed in any breach scenario |
|
No transit encryption |
Weak or absent transport encryption can expose messages to interception, while provider access depends on the platform’s encryption architecture and key-management model |
|
Uncontrolled retention |
Without configurable policies, sensitive conversations accumulate without limit |
|
Missing audit logs |
Limited audit logging can make incident reconstruction significantly more difficult and reduce the evidence available for regulatory reporting |
File Sharing
|
Risk |
What It Means in Practice |
|---|---|
|
Uncontrolled external sharing |
Consumer-grade file tools routinely bypass corporate security policies |
|
Missing access controls |
Files without role-based permissions create broad, unnecessary data exposure |
|
No integrity verification |
Without versioning, spotting unauthorized modifications is extremely difficult |
|
Insecure sync integrations |
Tools that connect to personal cloud storage are a persistent data leakage risk |
How to Assess NIS2 Compliance for a Communication Platform
- Confirm scope and national rules. Determine whether the organization is in scope and which Member State transposition and sector-specific requirements apply.
- Map communication systems and data flows. Identify platforms, integrations, external dependencies, administrators, stored data, and critical workflows.
- Assess Article 21 risk-management measures. Review access control, cryptography, incident handling, supply-chain security, business continuity, secure maintenance, and effectiveness testing.
- Close configuration and architectural gaps. Separate issues that can be fixed through settings or policy from gaps that require new infrastructure or a platform change.
- Document evidence. Maintain policies, risk assessments, logs, approvals, supplier reviews, incident procedures, and test results that demonstrate how controls operate in practice.
- Monitor and review. Reassess controls after incidents, major platform changes, significant vulnerabilities, regulatory updates, and other material changes in risk.
How TrueConf Server Supports NIS2 Risk-Management Measures
TrueConf Server is a self-hosted unified communications platform that organizations deploy on their own infrastructure, whether that’s on-site servers, a private cloud environment, or a fully air-gapped network. The organization controls the deployment environment, security configuration, data flows, and integration choices, which can make the communications layer easier to align with internal security and compliance policies.
Data Sovereignty
In an on-premises or isolated deployment, video conferences, chats, files, and recordings can remain within the organization’s own infrastructure. This reduces reliance on third-party cloud processing and supports NIS2 supply-chain risk management, although external integrations, federation, streaming, SMTP, and push-notification flows should still be reviewed as part of the organization’s security assessment.
Encryption
TrueConf Server protects communications traffic with encryption mechanisms built into its architecture:
- TLS-based protection for signaling and control data
- AES-256 for media traffic in the TrueConf protocol
- DTLS/SRTP for WebRTC media paths
- H.235 for H.323 scenarios
These protections are part of the platform’s communications architecture. For stored recordings, chat files, and other data at rest, organizations should also apply appropriate infrastructure-level controls, such as disk or partition encryption, retention policies, and access restrictions.
Access Control and Multi-Factor Authentication
- Integration with Active Directory and LDAP for centralized enterprise identity management
- Role-based access controls applied consistently across all platform functions
- MFA support that organizations can apply according to their risk assessment and access-control policy
- Administrator-defined permissions governing who can schedule meetings, access recordings, share files, and manage the system
Audit Logging
TrueConf Server provides reports and logs covering user connections, calls, messages, conference recordings, server events, and settings-change history:
- Ongoing internal security monitoring
- Supporting incident investigation and evidence collection for NIS2 reporting workflows
- Providing the evidentiary record needed for post-incident forensic reconstruction
Isolated and Air-Gapped Deployment
TrueConf Server can operate in completely isolated environments with zero internet connectivity. For organizations in defense, critical infrastructure, government, and other high-assurance environments, this capability can support architectures that require strict network segregation.
Secure External Collaboration
Guests and external participants can join TrueConf meetings through a browser-based WebRTC client, without installing a dedicated conferencing application or creating accounts on external conferencing platforms. Access is controlled through:
- Guest permissions
- Conference-level access restrictions
- Registration and approval settings
- Administrator-defined policies for external users
External participants can join without requiring accounts on a third-party conferencing service; identity and access architecture remains under the organization’s chosen configuration.
Business Continuity
TrueConf Server can support business continuity planning by giving organizations control over the deployment environment and operational procedures:
- Backup and restore of server settings
- Real-time and historical server monitoring
- Organization-controlled maintenance windows
- Disaster recovery planning based on the organization’s own infrastructure architecture
NIS2 Risk-Management Measure Mapping
|
NIS2 Requirement |
TrueConf Server Capability |
|---|---|
|
Cryptography and encryption |
TLS-based protection for signaling/control data, AES-256 for TrueConf media traffic, DTLS/SRTP for WebRTC, SRTP for SIP, H.235 for H.323 scenarios |
|
Access control and MFA |
AD/LDAP integration, group-based permissions, role-based administration, and 2FA/MFA support depending on configuration |
|
Incident handling and audit |
Reports and logs for connections, calls, messages, recordings, server events, and settings-change history |
|
Supply chain security |
On-premises or isolated deployment reduces third-party cloud processing, external integrations still require risk assessment |
|
Business continuity |
Backup and restore, monitoring, organization-controlled maintenance, and infrastructure-level disaster recovery planning |
|
Data protection |
Communications data can remain within the organization’s infrastructure in properly configured on-premises or isolated deployments |
|
Secure communications policy |
Security settings, access rules, authentication options, and user permissions can be configured and enforced at platform level |
Empower your video conferencing experience with TrueConf!
FAQ
Does TrueConf Server guarantee NIS2 compliance?
No single product can guarantee NIS2 compliance, and any vendor that claims otherwise is oversimplifying. Compliance depends on how an organization implements, configures, and operates its systems, alongside broader internal policies and governance. TrueConf Server provides technical controls that can help organizations address NIS2 requirements at the communications layer; overall compliance remains the organization’s responsibility.
Is TrueConf Server appropriate for NIS2 essential entities?
TrueConf Server can be evaluated by essential entities as part of a broader NIS2 compliance program. Its on-premises deployment model, encryption, MFA support, role-based access controls, audit logging, and isolated deployment options can support relevant technical and organizational measures when configured and operated according to the organization’s risk assessment and applicable national requirements.
Does TrueConf Server work with existing security infrastructure?
Yes, TrueConf Server integrates with enterprise identity providers via LDAP and Active Directory, can support SIEM workflows through log or report export, depending on the organization’s integration approach, and deploys behind existing firewalls and network security controls without requiring architectural changes.
How does TrueConf Server support NIS2 incident reporting?
The platform’s audit logs provide the evidentiary foundation that incident investigation and regulatory reporting depend on. Reports and logs covering connections, calls, messages, recordings, server events, and settings-change history can help security teams investigate communications-layer activity and prepare incident evidence where relevant.
How should organizations evaluate TrueConf Server for their NIS2 requirements?
The most effective starting point is a technical consultation with TrueConf focused on your organization’s sector, infrastructure model, communication workflows, and applicable NIS2 obligations. TrueConf specialists can help assess deployment options, security controls, integration requirements, and compliance-related configuration scenarios for your environment.
About the Author
Diana Shtapova is a product specialist and technology writer with three years of experience in the unified communications industry. At TrueConf, she leverages her deep product expertise to create clear and practical content on video conferencing platforms, collaboration tools, and enterprise communication solutions. With a strong background in product research and user-focused content development, Diana helps professionals and businesses understand core product features, adopt new technologies, and unlock the full potential of modern collaboration software.
Follow us on social networks